The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (WeChat/QQ chat logs, social media text) which is then interpolated into agent prompts to build a persona. This creates a clear vulnerability surface for indirect prompt injection attacks.
Ingestion points: tools/wechat_parser.py, tools/qq_parser.py, and tools/social_parser.py read content from user-provided files (txt, json, csv, sqlite).
Boundary markers: The generated SKILL.md organizes data into sections like ## PART A：关系记忆, but lacks robust sanitization or specific instructions to the agent to disregard malicious commands embedded within the chat history.
Capability inventory: The skill (and its generated descendants) has access to Read, Write, Edit, and Bash tools.
Sanitization: The parsing scripts perform basic text extraction and regex cleaning but do not filter for prompt injection patterns.
[DYNAMIC_EXECUTION]: The skill uses tools/skill_writer.py to dynamically generate a new SKILL.md file in the ./crushes/{slug}/ directory. This generated file contains instructions and data that are subsequently executed by the agent to simulate the persona.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute its internal Python scripts (wechat_parser.py, qq_parser.py, etc.) for processing sensitive data files.
[DATA_EXFILTRATION]: The skill requests access to extremely sensitive personal information, including private chat logs, photo metadata (GPS locations), and social media activity. While the skill claims to store data locally, the agent's access to this data within a context that has network capabilities (if not explicitly restricted by the platform beyond the skill's frontmatter) poses a significant privacy risk.

create-crush